MoDaCo Data Breach Exposes 879,703 User Accounts, Including Password Hashes
What Happened — In approximately January 2016, the UK‑based Android community MoDaCo suffered a data breach that exposed 879,703 subscriber records. The compromised data included email addresses, IP addresses, usernames and passwords stored as salted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Weak password hashing is a classic control gap; continuous credential‑protection monitoring is designed to detect and remediate such weaknesses before they lead to exposure.
- Demonstrating robust access‑control policies (strong hashing, MFA, regular audits) provides defensible evidence for audit readiness across frameworks.
- A breach of this scale highlights the need for an ongoing, evidence‑driven control‑assurance program that can prove due‑diligence to regulators and partners.
Who Is Affected – Technology‑SaaS platforms and any service that stores user credentials, especially those relying on legacy hashing algorithms.
Recommended Actions – Review and upgrade password‑storage mechanisms to modern, memory‑hard hashes (e.g., bcrypt, Argon2); enforce multi‑factor authentication; implement continuous monitoring of credential‑access events and retain audit‑ready evidence of these controls. Source: https://haveibeenpwned.com/api/v3/breach/MoDaCo
Technical Notes – The breach involved the exfiltration of a user database; passwords were stored as salted MD5 hashes, a weak algorithm vulnerable to offline cracking. No specific vulnerability (CVE) was disclosed, but the insecure hashing practice constitutes a control weakness. Source: https://haveibeenpwned.com/api/v3/breach/MoDaCo